CyberHunter
LinkedIn profile - Bastien Cordier Email: contact@bastiencordier.pro
// File transfer & sharing

Port 21: FTP

Legacy file transfer control channel. Credentials and files travel in clear text unless FTPS is used.

File Transfer ProtocolFTP control
21

How FTP works

File transfer & sharing
client:211/32/33/3backup.zipSTARTTLS if negotiated client:211/32/33/3backup.zipSTARTTLS if negotiated

Files are sent over port 21 in pieces and reassembled on the other side. Encryption is optional: it only happens if both sides negotiate TLS (STARTTLS).

Transport
TCP · UDP · SCTP
Exposure risk
7/10 high if reachable from the Internet
Encryption
Optional TLSTLS only if negotiated
IANA status
Assigned1 registered service
Range
Well-known (0-1023)
Category
File transfer & sharing
01 Security

Is port 21 dangerous?

Common attacks and weaknesses

  • Passwords sniffable on the network.
  • Anonymous login exposing or accepting files.
  • Old servers with backdoors or traversal bugs (vsftpd 2.3.4, ProFTPD mod_copy).

How to secure it

  • Replace with SFTP (port 22) or FTPS.
  • Disable anonymous access.
  • If FTP must stay, restrict it by IP and chroot users.
02 Registry

IANA registry entries for port 21

ServicePortTransportDescriptionReferenceUpdated
ftp 21 TCP, UDP, SCTP File Transfer Protocol [Control] RFC 959 -

// source: IANA service name and port number registry

03 Check it

Which program uses port 21, and is it reachable?

Linux

sudo ss -ltnup 'sport = :21'      # process listening on 21
sudo lsof -nP -i :21

macOS

sudo lsof -nP -i :21

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 21 -State Listen | Select LocalAddress, OwningProcess
Get-NetUDPEndpoint -LocalPort 21
netstat -ano | findstr :21

From another machine

nmap -p 21 -sV <host>
sudo nmap -sU -p 21 <host>
nc -zv <host> 21

Block it in the firewall

sudo ufw deny 21/tcp                                         # Linux (ufw)
New-NetFirewallRule -DisplayName "Block 21" -Direction Inbound -LocalPort 21 -Protocol TCP -Action Block  # Windows
04 FAQ
What is port 21 used for?

Legacy file transfer control channel. Credentials and files travel in clear text unless FTPS is used.

Is port 21 TCP or UDP?

Port 21 is registered for TCP and UDP and SCTP. In practice the service mostly uses TCP.

Is it safe to open port 21?

It is rated 7/10 (high) when exposed to the Internet. Passwords sniffable on the network. Replace with SFTP (port 22) or FTPS.

How do I check if port 21 is open?

On Linux run "ss -ltnup 'sport = :21'", on macOS "lsof -nP -i :21", and on Windows "netstat -ano | findstr :21" to see the local process. From another machine, "nmap -p 21 <host>" shows whether it is reachable.

05 Related
:445 SMB tcp · udp · critical risk :139 NetBIOS Session tcp · udp · high risk :69 TFTP udp · tcp · high risk :2049 NFS tcp · udp · sctp · high risk :873 rsync tcp · udp · high risk :20 File Transfer [Default Data] tcp · udp · sctp :115 Simple File Transfer Protocol tcp · udp :152 Background File Transfer Program tcp · udp

Latest vulnerability news

All news